HAL will be down for maintenance from Friday, June 10 at 4pm through Monday, June 13 at 9am. More information
Skip to Main content Skip to Navigation
Conference papers

Context-Based File Block Classification

Abstract : Because files are typically stored as sequences of data blocks, the file carving process in digital forensics involves the identification and collocation of the original blocks of files. Current file carving techniques that use the signatures of file headers and footers could be improved by first classifying each data block in the storage media as belonging to a given file type. Unfortunately, file block classification techniques tend to have low accuracy. One reason is that they do not account for compound files that contain subcomponents encoded as different data types. This paper presents a context-based classification approach that accounts for compound files and improves on block-by-block classification schemes by exploiting the contiguity of file blocks belonging to the same file on the storage media.
Document type :
Conference papers
Complete list of metadata

Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Tuesday, May 16, 2017 - 5:10:29 PM
Last modification on : Thursday, March 5, 2020 - 4:46:41 PM
Long-term archiving on: : Friday, August 18, 2017 - 12:25:16 AM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Luigi Sportiello, Stefano Zanero. Context-Based File Block Classification. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. pp.67-82, ⟨10.1007/978-3-642-33962-2_5⟩. ⟨hal-01523720⟩



Record views


Files downloads